A virtual private network (VPN) doesn’t remove anyone’s view of your internet traffic. It moves that view from your internet provider to the VPN company. That helps in a few situations and does nothing in many others, and VPN marketing blurs the line between the two.
This page explains what a VPN does, who sees what with and without one, why you can’t take a “no logs” promise on faith, and when a VPN is worth having. It doesn’t recommend providers or walk through setup. That belongs on a page with testable criteria. Common misconceptions covers the most common myths briefly. This page goes further.
What a VPN is, in plain terms
Normally your device connects to a website through your internet provider or whatever Wi-Fi network you’re on. With a VPN, an app on your device first builds an encrypted tunnel to a server run by the VPN company. Your traffic goes through the tunnel, comes out at that server and carries on to the website from there.
Picture sitting in a café. Without a VPN, the café’s network sees where your traffic is headed. With one, it sees an encrypted connection to a VPN server and nothing more. Websites see the VPN server’s address instead of the café’s.
Some VPNs are built for other jobs, such as employers letting staff reach internal systems. This page covers commercial VPN services that sell privacy to individuals.
Who sees what
| Who | Without a VPN | With a VPN |
|---|---|---|
| Your internet provider or Wi-Fi network | Can see which sites and services you connect to, even when HTTPS hides the page content | Sees that you’re connected to a VPN, and how much data you send |
| The website you visit | Sees your network’s address | Sees the VPN server’s address |
| The VPN company | Not involved | Sees your real address and where you connect |
| Anyone between the VPN and the website | Not applicable | Can’t read the content if the site uses HTTPS, which the VPN doesn’t add |
The last row matters. A VPN encrypts only the stretch between your device and the VPN server. Between the server and the website, your traffic is as protected as it would have been anyway, which is where HTTPS comes in. The FTC made the same point in 2018: the app typically obscures your traffic’s content from your internet provider or public Wi-Fi provider, shifting trust to the VPN provider.
When a VPN helps
A VPN is useful in a few specific cases.
On networks you don’t trust. The FTC’s own advice describes VPN apps as a way to shield personal information on public, open Wi-Fi. The need is smaller than it used to be. Chrome’s data showed more than half of page loads using HTTPS by 2016, and the share has kept rising. We couldn’t retrieve a current figure, but most sites now encrypt your connection by default, so a hostile café network sees much less than before.
When you don’t want your internet provider to see where you go. The provider still sees that you use a VPN, and how much data you send.
When you want to hide your network address from sites. That limits tracking and location guessing based on the address alone, though it’s one signal among many.
For some content restrictions and censorship. A VPN can make traffic appear to come from elsewhere. That’s a use for access, not for privacy, and rules on VPN use vary by country, so check local law.
When it doesn’t help
Logging in. If you sign in to an account, the site knows who you are, whatever address you use. Cookies, saved details and the information you type all identify you. Techlore, an educational privacy site, notes that hiding your IP address is one of many ways you can be tracked online.
Malware and phishing. A VPN doesn’t remove malware, and it doesn’t make a fake login page honest. It also doesn’t stop you handing over a password.
Anonymity. The VPN company knows your real address and where you connect, and often has your payment details. Anonymity needs different tools, and the next section explains why.
The trust problem
A VPN moves trust to one company, so everything depends on what that company does with what it sees. Most providers promise “no logs”. You can’t check that yourself.
Two US cases show why it matters. In 2017 the FBI used records from PureVPN to link a cyberstalking suspect’s two network addresses, even though the company’s policy said it kept no logs that could identify or monitor a user’s activity. The suspect was later sentenced to prison for stalking his former housemate. In 2016 the US Department of Homeland Security obtained connection logs on one user from the company behind IPVanish, which advertised a strict zero-logs policy at the time. IPVanish later changed owners. Industry commentators note these were the only two such cases one 100-provider review found, which fits a world where most providers are never tested.
The opposite case also exists. In April 2023 Swedish police arrived at the Gothenburg office of Mullvad with a search warrant to seize computers holding customer data. Mullvad says no such data existed, and after the company argued the seizure would be illegal and police consulted the prosecutor, they left without taking anything. That’s Mullvad’s own account.
Note what these cases do and don’t prove. “No logs” can mean no records of what you browse while still keeping records of when you connected and from where, and that was the type of record handed over in the PureVPN case. Independent audits help, but an audit covers a defined scope and date. It doesn’t prove a provider can never log anything. A provider with nothing stored is safer than one promising not to look, and you have no way to see which you’re dealing with except the track record.
Free and cheap VPN apps
A free service has to make money somewhere. In 2017, researchers at Australia’s CSIRO, the University of New South Wales and UC Berkeley studied 283 Android VPN apps from Google Play. They found malware indicators in 38% of the apps, third-party tracking libraries in 75% and requests for sensitive permissions such as text messages in 82%. 18% used tunnelling without encryption. Two apps were found injecting JavaScript into users’ traffic for advertising and tracking. The study is dated and covers one platform, but the incentives it describes haven’t changed.
The FTC’s 2018 advice was to research the app before installing it, review the permissions it asks for, check that it encrypts traffic and see whether it shares information with third parties. That advice still holds. An app with VPN permissions can see all your traffic, which is more access than most apps get.
Reviews and ownership
Most “best VPN” pages are advertising. VPN companies pay affiliate commissions, and review sites that carry the links have a reason to rank the products that pay most. A 2025 report from SafePaper, a site that publishes VPN research, argued that many top lists come from hidden business ties, and that some leading VPN brands share parent companies, which in some cases also own review sites. We haven’t verified those ownership claims independently. The practical point holds anyway: if one VPN ranks first everywhere, ask who benefits.
For this site, we use no affiliate links, accept no payment for placement and don’t rank by popularity. Our recommendation pages will say what each pick has been checked against.
VPN versus Tor
Tor is a free network of volunteer-run relays. Your traffic passes through three of them, each knowing only the one before and after, so no single relay knows both who you are and where you’re going. A VPN is the reverse: one company sees both. The cost is speed. Tor is slower, and some sites treat it differently.
They answer different questions. A VPN is a fast way to move trust away from your internet provider or local network. Tor is a way to avoid trusting any single party, at a cost in speed. Comparison sites run by VPN vendors note that connecting to a VPN first and then using Tor hides the fact that you use Tor from your internet provider. Stacking them adds complexity, so it’s justified only by a specific need. For most people, Tor is rarely needed. People who need strong anonymity should read Tor’s own documentation.
Do you need one?
The answer depends on your threat model, which threat modeling helps you judge.
| Your situation | Does a VPN help? |
|---|---|
| You use public Wi-Fi often and want to hide traffic from the network | A little. HTTPS already protects most content |
| You don’t want your internet provider to see which sites you visit | Yes, but the VPN company sees them instead |
| You want to hide your network address from websites | Yes, in part. Logins and cookies still identify you |
| You want to stay anonymous | No. Look at other tools and think carefully about your threat |
| You think your VPN will stop phishing or malware | No |
If you decide a VPN is worth it, choose a provider that publishes how it handles your data, has been independently audited and has a track record. Avoid free apps with unclear owners. Expect a recurring cost, some loss of speed and some sites that treat VPN traffic as suspicious.
Sources
- FTC Provides Tips on Using VPN Apps, US Federal Trade Commission, February 2018.
- FTC warning users to do homework before using VPN apps, SC Media, 2018 (quoting the FTC).
- FBI uses PureVPN’s ‘non-existent’ logs to track down internet stalker, BetaNews, 2017.
- Cyberstalking Case Highlights How VPN Provider Claims About Not Keeping Logs Are Often False, Techdirt, 2017.
- IPVanish Provides Logs to Authorities, CyberInsider, accessed October 2026.
- Here Are 3 No-Log VPNs That Shared Data With Governments, TechNadu, accessed October 2026.
- Your VPN could be a privacy trap, IAPP, accessed October 2026.
- Mullvad VPN was subject to a search warrant. Customer data not compromised, Mullvad, April 2023.
- Your favourite VPN app is harvesting your personal information, CIO, 2017 (reporting the CSIRO study).
- Can you trust your Android VPN client?, Help Net Security, 2017.
- An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps, CSIRO Data61, UNSW, ICSI and UC Berkeley, 2016.
- Half of Chrome pageloads are HTTPS, Threatpost, 2016.
- HTTPS encryption on the web, Google Transparency Report, accessed October 2026.
- SafePaper Exposes Hidden VPN Ties Behind “Best VPN” Rankings, HackerNoon, 2025.
- Can you trust a VPN review website that owns VPN services?, CyberInsider, accessed October 2026.
- VPN vs Tor, IVPN, accessed October 2026.
- Tor vs VPN: what’s the difference, Kaspersky, accessed October 2026.
- VPNs: what they do and what they don’t, Techlore, accessed October 2026.